Privacy.Privacy notice

Three companies trade from this address, and which one holds your information depends on what you came to us for. This matters because it decides who you make a request to.

• Girl Boss HQ Limited is responsible for everything to do with courses, qualifications, enquiries made through this website, and your student records.
• Cherry Tree Farmhouse LTD is responsible for information about a stay in the house.
• Cherry Tree Cafe LTD is responsible for information about a food or drink order.

Where a single enquiry touches more than one of them, for example a course booked with a room, each company is responsible for its own part of it.

We only ask for what we need for the thing you are doing, and we tell you at the point we ask.

• If you request a callback: your name, your mobile number, what you want to talk about and when you would like to be rung. We use it to ring you back about that enquiry.
• If you book a course: your contact details, the course and dates, what you have paid, and anything you tell us about how we should support you on the day.
• If you enrol on a regulated qualification: your date of birth and evidence of your identity, because the awarding organisation requires both before it will register you as a learner.
• If you tell us about a health condition, a pregnancy, an allergy or a learning need: we treat that as special category information and it is handled under the section below.
• If you attend as a model: your consent records, a medical history and a contraindication screen, held separately from any consent you give for photography.
• If you stay in the house: your dates, who is staying with you and what you have paid for the room.

We do not buy contact lists and we do not add you to a marketing list because you asked us a question. Marketing is a separate, unticked choice, and you can change it whenever you want.

• Performing a contract with you: delivering the course you booked, providing the room you booked, and everything that goes with them.
• Complying with a legal obligation: keeping financial records, meeting the requirements of the awarding organisation, and health and safety obligations.
• Our legitimate interests: answering an enquiry, keeping our records accurate, preventing fraud and improving how we run the academy. Where we rely on this, we have considered whether it is fair to you, and you can object.
• Your consent: marketing messages, photography and images, and anything else we tell you is optional. Consent can be withdrawn at any time and withdrawing it is as easy as giving it.

Some of what we ask is sensitive: a pregnancy, an allergy, a medical history, a learning difficulty. We ask because a trainer needs to know before somebody is in a room with a needle, not because it is interesting.

It is held apart from the rest of your record, seen by fewer people, and every time somebody opens it that is recorded. Trainers are told that a disclosure exists and to speak to the office; they are not shown the content.

We share what we have to, with the people who have to have it, and no more than that.

• The awarding organisation, where you are on a regulated qualification, so that you can be registered and certificated.
• Our payment provider, so that a payment or a refund can be taken or made.
• The suppliers who run our systems for us, such as the customer system that sends our emails and the service that hosts this website. They act on our instructions and cannot use your information for their own purposes.
• Our insurers and our professional advisers, where there is a claim or a dispute.
• The police, a regulator or a court, where we are required to.

We do not sell your information to anybody, for any purpose, in any circumstances.

We keep information for as long as there is a reason to, and then we get rid of it.

• An enquiry that does not become a booking: kept while we are still in a conversation with you, and then deleted.
• Student records and assessment evidence: kept for as long as the awarding organisation and our insurers require, because an insurer or an employer can ask us to verify a certificate years after you qualified.
• Financial records: kept for the period required by tax law.
• Consent records, including photography consent and its withdrawal: kept for as long as we hold the material the consent relates to, because a consent record is the evidence that we were entitled to use it.

You have the right to ask us for a copy of the information we hold about you, to have it corrected if it is wrong, to have it deleted in some circumstances, to restrict or object to how we use it, and to have some of it sent to somebody else. Where we rely on your consent, you can withdraw it at any time.

Ask us and we will deal with it. We do not charge for it, and we will reply within one month unless the request is unusually complicated, in which case we will tell you and explain why.

What this site stores on your device, and what it does not, is set out separately in our cookie policy.

If you think we have got something wrong with your personal information, tell us at /legal/data-protection-complaints. We will acknowledge your complaint within 30 days and keep you posted until it is closed.

You can also complain to the Information Commissioner's Office at ico.org.uk, and you can go to them at any time. You do not have to come to us first.